CVE-2008-0062: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 10.1% chance of exploitation in the next 30 days.

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only; version 7.10 only
• Debian Debian Linux: version 3.1 only; version 4.0 only
• Fedoraproject Fedora: version 7 only; version 8 only
• Mit Kerberos 5: up to and including 1.6.3

Published 2008-03-19. Last modified 2026-06-16.